Conectiva Linux Advisory: apache/mod_ssl

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : apache
SUMMARY   : off-by-one mod_ssl buffer overflow
DATE      : 2002-07-02 11:21:00
ID        : CLA-2002:504
RELEVANT
RELEASES  : 6.0, 7.0, 8

- -------------------------------------------------------------------------

DESCRIPTION
 Apache[1] is the most popular webserver in use today. "mod_ssl"[2] is
 an Apache module which enables the use of encrypted connections
 ("https://") to the web server and provides a set of crypto and
 authentication related functions.
 
 This module is not part of the apache distribution, but is bundled
 and enabled by default in the Conectiva Linux Apache packages. 
 
 An off-by-one buffer overflow vulnerability exists in the code which
 handles entries in .htaccess files in mod_ssl <= 2.8.9. It was
 discovered[3] by Frank DENIS (Jedi/Sector One) <j@pureftpd.org>.
 
 The htaccess mechanism is disabled by default in Conectiva Linux and
 can be controled by the "AllowOverride" variable in the apache
 configuration file. It is useful to allow non privileged users to
 customize the configuration of their sites.
 
 An attacker who can manipulate the contents of the .htaccess file can
 potentially cause a DoS or even execute arbitrary commands in the
 httpd service context, which is run by an unprivileged user
 (typically "www" or "nobody").


SOLUTION
 It is recommended that all apache users upgrade their packages.
 
 IMPORTANT: the apache server has to be restarted after upgrading the
 packages. To do this, please execute, as root:
 
 # service httpd stop
 
 (wait a few seconds and check with "ps ax|grep httpd" if there are
 any httpd processes running. On a busy webserver this could take a
 little longer.)

 and:
 
 # service httpd start
 
 
 REFERENCES:
 1. http://httpd.apache.org
 2. http://www.modssl.org
 3. http://online.securityfocus.com/archive/1/279074


DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-devel-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-doc-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/apache-1.3.26-1U60_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-devel-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-doc-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/apache-1.3.26-1U70_5cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-devel-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-doc-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/apache-1.3.26-1U8_2cl.src.rpm

ADDITIONAL INSTRUCTIONS
 Users of Conectiva Linux version 6.0 or higher may use apt to perform 
 upgrades of RPM packages:
 - add the following line to /etc/apt/sources.list if it is not there yet
   (you may also use linuxconf to do this):

 rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(replace 6.0 with the correct version number if you are not running CL6.0)

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en